How severe is CVE-2026-40910?

CVE-2026-40910 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity low, and availability none.

Is CVE-2026-40910 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (19th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-40910?

CVE-2026-40910 affects Fatedier Frp. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-40910?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-40910 have an EU (EUVD) identifier?

Yes. CVE-2026-40910 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-24477.

When was CVE-2026-40910 published?

CVE-2026-40910 was published on 2026-04-21 and last updated on 2026-06-17.

CVE-2026-40910

CVE-2026-40910 is a medium-severity vulnerability in Fatedier Frp with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-287.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
EPSS exploit prediction: 0% (19th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-24477
Weakness: CWE-287
Affected product: Fatedier Frp
Published: 2026-04-21
Last modified: 2026-06-17

Description

frp is a fast reverse proxy. From 0.43.0 to 0.68.0, frp contains an authentication bypass in the HTTP vhost routing path when routeByHTTPUser is used as part of access control. In proxy-style requests, the routing logic uses the username from Proxy-Authorization to select the routeByHTTPUser backend, while the access control check uses credentials from the regular Authorization header. As a result, an attacker who can reach the HTTP vhost entrypoint and knows or can guess the protected routeByHTTPUser value may access a backend protected by httpUser / httpPassword even with an incorrect Proxy-Authorization password. This issue affects deployments that explicitly use routeByHTTPUser. It does not affect ordinary HTTP proxies that do not use this feature. This vulnerability is fixed in 0.68.1.

Frequently asked questions

What is CVE-2026-40910?: frp is a fast reverse proxy. From 0.43.0 to 0.68.0, frp contains an authentication bypass in the HTTP vhost routing path when routeByHTTPUser is used as part of access control. In proxy-style requests, the routing logic uses the username from Proxy-Authorization to select the routeByHTTPUser backend, while the access control check uses credentials from the regular Authorization header. As a result, an attacker who can reach the HTTP vhost entrypoint and knows or can guess the protected routeByHTTPUser value may access a backend protected by httpUser / httpPassword even with an incorrect Proxy-Authorization password. This issue affects deployments that explicitly use routeByHTTPUser. It does not affect ordinary HTTP proxies that do not use this feature. This vulnerability is fixed in 0.68.1.
How severe is CVE-2026-40910?: CVE-2026-40910 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity low, and availability none.
Is CVE-2026-40910 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (19th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-40910?: CVE-2026-40910 affects Fatedier Frp. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-40910?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-40910 have an EU (EUVD) identifier?: Yes. CVE-2026-40910 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-24477.
When was CVE-2026-40910 published?: CVE-2026-40910 was published on 2026-04-21 and last updated on 2026-06-17.

References

https://github.com/fatedier/frp/security/advisories/GHSA-pq96-pwvg-vrr9

Affected products (1)

cpe:2.3:a:fatedier:frp:*:*:*:*:*:*:*:*

Other CWE-287 (Improper Authentication) vulnerabilities

CVE-2026-45480 — Critical (CVSS 10.0): Improper authentication in Azure Active Directory allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-46389 — Critical (CVSS 10.0): UDS Identity Config builds the Keycloak configuration image (realm, plugins, theme, truststore, JARs) consumed by UDS…
CVE-2026-10611 — Critical (CVSS 10.0): An authentication bypass vulnerability exists in MISP when LDAP mixed authentication is enabled with OTP enforcement.…
CVE-2026-47280 — Critical (CVSS 10.0): Improper authentication in Azure Resource Manager (ARM) allows an unauthorized attacker to elevate privileges over a…
CVE-2026-42822 — Critical (CVSS 10.0): Improper authentication in Azure Local Disconnected Operations allows an unauthorized attacker to elevate privileges…
CVE-2026-20182 — Critical (CVSS 10.0): May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and…

Browse all CWE-287 (Improper Authentication) vulnerabilities →